{"action":"Upgrade modx/revolution to 2.7.1-pl or later.","affected":[{"fixed":"2.7.1-pl","introduced":"0"}],"component":"modx/revolution","cve_ids":["CVE-2018-20755"],"ecosystem":"Packagist","epss":0.00857,"exploited":false,"fixed_versions":["2.7.1-pl"],"ghsa_id":"GHSA-q4c2-q63g-62j7","id":"tcs_01M5KF6X2TJNQSZYXWA40HA1H6","modified_at":"2025-07-11T23:12:13.991667Z","published_at":"2022-05-14T01:36:14Z","references":["https://osv.dev/vulnerability/GHSA-q4c2-q63g-62j7","https://nvd.nist.gov/vuln/detail/CVE-2018-20755","https://github.com/modxcms/revolution/issues/14102","https://github.com/modxcms/revolution/pull/14335","https://github.com/modxcms/revolution/commit/a12920f1698d3be8e6ba07d746da46e511b911b6","https://github.com/modxcms/revolution"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-q4c2-q63g-62j7","url":"https://osv.dev/vulnerability/GHSA-q4c2-q63g-62j7"}],"summary":"MODX Revolution vulnerable to XSS attack through its User Photo field"}